{"id":"CVE-2025-69723","kind":"vulnerability","aliases":["CVE-2025-69723"],"related":[],"title":"LocalStack: reflected XSS in v4.9.2 runs script in a victim's browser","description":"A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL.","summary":"LocalStack v4.9.2 reflects part of a crafted URL into a page without escaping it. A victim who opens such a link has attacker JavaScript run in their browser session.","severity":"medium","cvss":null,"epss":0.00148,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws-emulation","ci","developers","localstack","package"],"not_affected_if":["not-exposed-to-browser","other-version"],"how_to_check":"- Check the installed LocalStack version with `localstack --version` or the image tag in your compose file.\n- Look for LocalStack web endpoints exposed beyond your own machine or developer network.","fix":"- Upgrade LocalStack past `4.9.2` once a fixed release is published; the sources do not name a fixed version.\n- Until then, do not expose the LocalStack port to untrusted users or browsers you do not control.","status":"open","published_at":"2026-10-22T19:17:33+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T05:00:21+00:00","updated_at":"2026-10-25T05:00:21+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:00:21Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade LocalStack past `4.9.2` once a fixed release is published; the sources do not name a fixed version.\n- Until then, do not expose the LocalStack port to untrusted users or browsers you do not control.","reach":"internet","title":"LocalStack: reflected XSS in v4.9.2 runs script in a victim's browser","impact":"low","summary":"LocalStack v4.9.2 reflects part of a crafted URL into a page without escaping it. A victim who opens such a link has attacker JavaScript run in their browser session.","category":"package","nicknames":[],"who_cares":["localstack","aws-emulation","developers","ci"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker script runs in the victim's browser session against LocalStack.","analyst_note":"Confirm the fixed version and whether the affected endpoint is on by default, using the NVD entry and the LocalStack project release notes.","how_to_check":"- Check the installed LocalStack version with `localstack --version` or the image tag in your compose file.\n- Look for LocalStack web endpoints exposed beyond your own machine or developer network.","needs_analyst":true,"not_affected_if":["other-version","not-exposed-to-browser"],"who_is_affected":"Teams running LocalStack v4.9.2 locally or in CI where a developer can be lured to a crafted link while LocalStack is reachable from the browser. Teams not running that version can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000602,"input_tokens":3324,"output_tokens":540,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':14A,17A '-69723':15A,18A 'allow':66C 'arbitrari':70C 'attack':48B,67C 'aw':20B 'aws-emul':19B 'browser':12A,53B,79C 'ci':22B 'context':74C 'craft':32B,82C 'cross':58C 'cross-sit':57C 'cve':13A,16A 'develop':23B 'emul':21B 'escap':38B 'execut':69C 'javascript':49B,71C 'link':46B 'localstack':1A,24B,26B,64C 'open':43B 'packag':25B 'page':36B 'part':29B 'reflect':2A,28B,56C 'run':6A,50B 'script':7A,60C 'session':54B 'site':59C 'url':33B,83C 'user':77C 'v4.9.2':5A,27B,65C 'via':80C 'victim':10A,41B 'vulner':62C 'without':37B 'xss':3A,61C","nicknames":[],"mitigations":[],"who_affected":"Teams running LocalStack v4.9.2 locally or in CI where a developer can be lured to a crafted link while LocalStack is reachable from the browser. Teams not running that version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-69723","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69723","severity":null,"published_at":"2026-10-22T19:17:33+00:00","modified_at":"2026-10-23T19:57:42+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2025-69723","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-69723","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}